In plain words
Think of a restaurant hygiene inspection. A Type I SOC 2 is the inspector walking in once and confirming the kitchen is set up properly. A Type II is the inspector coming back again and again over six months and checking that the staff actually washed their hands, every shift.
SOC 2 (System and Organization Controls 2) is a report written by an independent auditor about a company that handles other companies’ data, such as a software supplier, a payment processor or a cloud service. The auditor checks the company’s security controls against a set of criteria published by the AICPA, the US body for accountants, and writes down what they tested and what they found. 1
In fintech, SOC 2 usually comes up during due diligence. A bank, a card programme or a large customer wants to know whether your systems can be trusted with their data and their customers’ money, and a SOC 2 report is one of the standard ways to show them.
How it works
How a SOC 2 report comes together
From choosing the scope to handing the report to a partner.
-
1
Choose the scope
Decide which systems, teams and suppliers are covered, and which Trust Services Criteria apply beyond security.
-
2
Close the gaps
A readiness review shows missing controls: access reviews, logging, change management, supplier checks, incident response. You fix them and start keeping evidence.
-
3
Run the controls and keep the evidence
For a Type II, controls must work every day of the observation period. The auditor samples tickets, logs and approvals from across it.
-
4
Receive and share the report
A licensed CPA firm issues the report, including any exceptions. You share it with customers and partners, usually under a non-disclosure agreement.
The five Trust Services Criteria
A SOC 2 report is built around five areas. Security, also called the common criteria, is always included. The other four are optional, and you add them when customers depend on them. 1
Security (required)
Systems are protected against unauthorised access: logins, permissions, network protection, monitoring and incident response.
Availability
The service is up and usable as promised, with backups, capacity planning and recovery plans.
Processing integrity
Processing is complete, accurate and on time. Relevant when you calculate balances, fees or payouts for others.
Confidentiality
Information marked confidential, such as contracts or business data, is protected and disposed of properly.
Privacy
Personal information is collected, used, kept and deleted in line with your privacy notice.
Type I vs Type II
The two types answer different questions. Type I asks “is it designed properly?” Type II asks “did it actually work?” Most banks and enterprise buyers want a Type II, and accept a Type I only as a first step.
| Type I | Type II | |
|---|---|---|
| What it checks | Design of controls | Design and operating effectiveness |
| Time covered | One specific date | A period, often 6 to 12 months; first reports are sometimes shorter |
| How long to get | Typically weeks after readiness | The observation period plus a few weeks of reporting |
| How partners see it | A sign of intent | Evidence the controls work in practice |
| Renewal | Usually replaced by a Type II | Usually renewed every year, covering a new period |
A SOC 2 is an attestation, not a certificate. There is no “pass”. The report describes your system, lists the controls, shows how the auditor tested them and records any exceptions. A reader decides for themselves whether the exceptions matter.
SOC 2 vs ISO 27001
The two are often confused, and partners in different markets prefer one or the other. They cover a lot of the same ground. 2
| SOC 2 | ISO 27001 | |
|---|---|---|
| What you get | An attestation report | A certificate |
| Who issues it | A licensed CPA firm | An accredited certification body |
| What it looks at | Specific controls against the Trust Services Criteria | Your whole information security management system |
| Who reads it | Customers and partners, usually under NDA | Anyone: the certificate can be published |
| Where it is most common | United States and US-led buyers | UK, EU, Gulf and internationally |
| Cycle | New report each year | Three-year certificate with yearly surveillance audits |
SOC 2 in the UK, EU and Gulf
SOC 2 is a US framework, and no UK, EU or Gulf law requires it. Its weight depends on who you sell to.
- United Kingdom. Banks and enterprise buyers often accept ISO 27001, sometimes alongside Cyber Essentials. SOC 2 matters most if you sell to US companies or to UK firms with US parents. Regulated firms still have their own operational resilience and outsourcing duties, and a supplier’s report is only one input.
- European Union. Under DORA, financial firms must assess and monitor their ICT suppliers. A SOC 2 or ISO 27001 report helps them do that, but does not replace their own due diligence.
- Gulf. Regulators set their own cyber rules, such as the SAMA Cyber Security Framework in Saudi Arabia. Partners there tend to ask for ISO 27001 and evidence against local rules more often than for SOC 2.
Example: a payouts startup meets its first bank partner
Omar runs a startup that calculates and sends payouts for gig workers. A bank partner sends a security questionnaire and asks for a SOC 2 Type II.
- Scope. Omar chooses security plus processing integrity, because the bank cares most that payout amounts are right.
- Readiness. A readiness review finds no regular access reviews, shared admin accounts and no record of who approved code changes. The team fixes these over two months.
- Bridge to the partner. Omar gets a Type I to show progress, shares his latest penetration test summary, and agrees a date for the Type II.
- Observation. For six months every access change, deployment and incident is logged with an approval. The auditor samples from all six months.
- Report. The Type II has one exception: a leaver’s account was removed late. Omar shares the report under NDA with his management response, and the bank signs.
Common misconceptions
“We are SOC 2 certified.”
There is no SOC 2 certificate. You have a SOC 2 report, for a stated scope and period, written by a named audit firm.
“Our cloud provider has SOC 2, so we are covered.”
Their report covers their data centres and services. Your application, access rights, code changes and support processes are your responsibility.
“A clean report means we are secure.”
It means the controls in scope worked as described during the period. It is not a guarantee against breaches, which is why partners also ask for penetration tests.
FAQ
What is the difference between SOC 2 Type I and Type II?
A Type I report checks that your security controls are properly designed at a single point in time. A Type II report also tests that those controls actually worked over a period, usually several months, which is why partners trust it more.
Is SOC 2 a certification?
No. SOC 2 is an attestation report written by an independent CPA firm. There is no SOC 2 certificate and no pass mark: the report describes your controls, the auditor's tests and any exceptions found.
How long does it take to get a SOC 2 report?
A Type I can follow a few months of preparation. A Type II needs an observation period, often 6 to 12 months and sometimes shorter for a first report, plus a few weeks for the auditor to write it up.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is a US attestation report on specific controls, read mainly by customers under NDA. ISO 27001 is an international certification of your whole information security management system, issued by an accredited certification body. Many controls overlap.
Do UK or EU fintechs need SOC 2?
No law requires it. It is a commercial expectation, most common when you sell to US companies or to enterprise buyers who use it as their standard. Many UK and EU partners accept ISO 27001 instead.
Which Trust Services Criteria do I need?
Security is always in scope. Availability, processing integrity, confidentiality and privacy are optional, and you choose them based on what your customers rely on you for.
Related terms
Sources
-
1
AC
AICPA & CIMA SOC 2: SOC for Service Organizations, Trust Services Criteria
https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2 -
2
I
ISO ISO/IEC 27001 Information security management systems
https://www.iso.org/standard/27001
